Systematization of Knowledge: Security and Safety in the Model Context Protocol Ecosystem

TL;DR

This paper systematically analyzes security and safety risks in the Model Context Protocol ecosystem, providing a taxonomy of threats, vulnerabilities, defenses, and a roadmap for secure autonomous agent systems.

Contribution

It offers the first comprehensive taxonomy of security and epistemic safety risks in MCP, analyzing vulnerabilities and surveying defenses for agentic AI ecosystems.

Findings

Identifies structural vulnerabilities in MCP primitives.

Distinguishes between security threats and epistemic hazards.

Reviews state-of-the-art defenses and proposes a security roadmap.

Abstract

The Model Context Protocol (MCP) has emerged as the de facto standard for connecting Large Language Models (LLMs) to external data and tools, effectively functioning as the "USB-C for Agentic AI." While this decoupling of context and execution solves critical interoperability challenges, it introduces a profound new threat landscape where the boundary between epistemic errors (hallucinations) and security breaches (unauthorized actions) dissolves. This Systematization of Knowledge (SoK) aims to provide a comprehensive taxonomy of risks in the MCP ecosystem, distinguishing between adversarial security threats (e.g., indirect prompt injection, tool poisoning) and epistemic safety hazards (e.g., alignment failures in distributed tool delegation). We analyze the structural vulnerabilities of MCP primitives, specifically Resources, Prompts, and Tools, and demonstrate how "context" can be weaponized to trigger unauthorized operations in multi-agent environments. Furthermore, we survey state-of-the-art defenses, ranging from cryptographic provenance (ETDI) to runtime intent verification, and conclude with a roadmap for securing the transition from conversational chatbots to autonomous agentic operating systems.